identity: service facade api.sx — login/verify/revoke/logout (10 tests, Phase 1 complete)

identity:start() spawns one coordinator owning the token table + session
registry and exposes the whole-domain ops. The coordinator is the owner
sessions notify on idle timeout, so an expired session deregisters itself
— timeout-driven, never swept. verify/2 answers identity only ({active,
Subject, Client, Scope}); permission is delegated to acl. 39/39.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/conformance.sh

@@ -31,6 +31,7 @@ SUITES=(
   "session|id-session-test-pass|id-session-test-count"
   "token|id-token-test-pass|id-token-test-count"
   "registry|id-registry-test-pass|id-registry-test-count"
+  "api|id-api-test-pass|id-api-test-count"
 )
 
 cat > "$TMPFILE" << 'EPOCHS'
@@ -45,15 +46,19 @@ cat > "$TMPFILE" << 'EPOCHS'
 (load "lib/identity/session.sx")
 (load "lib/identity/token.sx")
 (load "lib/identity/registry.sx")
+(load "lib/identity/api.sx")
 (load "lib/identity/tests/session.sx")
 (load "lib/identity/tests/token.sx")
 (load "lib/identity/tests/registry.sx")
+(load "lib/identity/tests/api.sx")
 (epoch 100)
 (eval "(list id-session-test-pass id-session-test-count)")
 (epoch 101)
 (eval "(list id-token-test-pass id-token-test-count)")
 (epoch 102)
 (eval "(list id-registry-test-pass id-registry-test-count)")
+(epoch 103)
+(eval "(list id-api-test-pass id-api-test-count)")
 EPOCHS
 
 timeout 600 "$SX_SERVER" < "$TMPFILE" > "$OUTFILE" 2>&1